AV-Comparatives says 11 endpoint security products pass its toughest EPR test yet

AV-Comparatives said 11 of 14 enterprise security products earned its Certified Leader status in the 2026 Endpoint Prevention and Response test, which used AI-assisted attack scenarios and measured both protection and operational burden. The results matter because the test mirrors real intrusion chains and highlights which tools can stop modern attacks without overwhelming IT teams with false alarms.

Why it matters: - AV-Comparatives’ EPR test is designed to show how endpoint security products perform against full attack chains, not just isolated malware samples. - The 2026 results come as attackers increasingly use AI to automate parts of intrusions, including a recent campaign that Anthropic said used Claude Code to automate up to 90% of a multi-stage espionage operation. - The test also measures operational costs, which helps enterprises judge whether strong protection comes with heavy day-to-day IT overhead.

What happened: - AV-Comparatives began the 2026 Endpoint Prevention and Response test in May 2026. - The test evaluated 14 leading enterprise security products across 50 multi-stage attack scenarios. - The scenarios were split into three consecutive phases and several were built with AI-assisted development methods. - 11 of the 14 products earned Certified Leader status, AV-Comparatives’ highest distinction. - The certified products were Bitdefender, Broadcom, Check Point, Elastic, ESET, Fortinet, G Data, Palo Alto Networks, TrendAI, VIPRE and WithSecure. - The three products that did not reach the threshold were not named under AV-Comparatives’ methodology.

The details: - The EPR test is now in its seventh year and has become a reference point in the enterprise security market. - The certification threshold has risen from 90% to 92% since the test launched. - To qualify as Certified Leader, a product must perform across all three phases of the attack chain. - Phase 1, Endpoint Compromise & Foothold, covers initial access through phishing or exploitation and persistence on the device. - Phase 2, Internal Propagation, tracks lateral movement, privilege escalation and target discovery inside the network. - Phase 3, Asset Breach, covers theft or encryption of sensitive data or critical systems. - AV-Comparatives measures each phase separately for Active Response, where the product automatically stops the attack, and Passive Response, where the product detects and reports it. - The methodology follows the MITRE ATT&CK Matrix for Enterprise, even though the pass criteria are proprietary to AV-Comparatives. - The report also includes a CyberRisk Quadrant and product-level detail results. - The full report is available here. - AV-Comparatives also shares updates on LinkedIn, Instagram, Facebook and YouTube.

Between the lines: - The focus on operational costs suggests that detection accuracy alone is no longer enough for enterprise buyers. - High false-positive rates and manual review work can make a technically strong product expensive to run in practice. - The decision not to rank the 11 certified products reflects the idea that Certified Leader is a qualification standard, not a leaderboard. - AV-Comparatives’ framing also suggests that AI is now part of both sides of the security race, with defenders and attackers using machine learning to sharpen their tools.

What's next: - Enterprises evaluating endpoint protection can use the 2026 EPR results to compare both resilience and workload impact. - The test’s structure suggests future editions will likely keep tracking AI-enabled attacks and operational friction as core buying criteria. - Market attention is likely to stay on products that can stop multi-stage attacks without flooding security teams with alerts.

The bottom line: - AV-Comparatives says the strongest endpoint tools now have to do two things at once: stop sophisticated attacks and stay manageable in daily enterprise operations.